From owner-svn-src-head@freebsd.org Tue Apr 26 23:13:50 2016 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 43E60B1DAD1; Tue, 26 Apr 2016 23:13:50 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 05E331888; Tue, 26 Apr 2016 23:13:49 +0000 (UTC) (envelope-from cem@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u3QNDnTm088351; Tue, 26 Apr 2016 23:13:49 GMT (envelope-from cem@FreeBSD.org) Received: (from cem@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u3QNDnpF088349; Tue, 26 Apr 2016 23:13:49 GMT (envelope-from cem@FreeBSD.org) Message-Id: <201604262313.u3QNDnpF088349@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: cem set sender to cem@FreeBSD.org using -f From: "Conrad E. Meyer" Date: Tue, 26 Apr 2016 23:13:49 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r298675 - in head/sys: netinet netinet6 X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Apr 2016 23:13:50 -0000 Author: cem Date: Tue Apr 26 23:13:48 2016 New Revision: 298675 URL: https://svnweb.freebsd.org/changeset/base/298675 Log: in_lltable_alloc and in6 copy: Don't leak LLE in error path Fix a memory leak in error conditions introduced in r292978. Reported by: Coverity CIDs: 1347009, 1347010 Sponsored by: EMC / Isilon Storage Division Modified: head/sys/netinet/in.c head/sys/netinet6/in6.c Modified: head/sys/netinet/in.c ============================================================================== --- head/sys/netinet/in.c Tue Apr 26 23:09:47 2016 (r298674) +++ head/sys/netinet/in.c Tue Apr 26 23:13:48 2016 (r298675) @@ -1004,6 +1004,17 @@ struct in_llentry { /* * Do actual deallocation of @lle. + */ +static void +in_lltable_destroy_lle_unlocked(struct llentry *lle) +{ + + LLE_LOCK_DESTROY(lle); + LLE_REQ_DESTROY(lle); + free(lle, M_LLTABLE); +} + +/* * Called by LLE_FREE_LOCKED when number of references * drops to zero. */ @@ -1012,9 +1023,7 @@ in_lltable_destroy_lle(struct llentry *l { LLE_WUNLOCK(lle); - LLE_LOCK_DESTROY(lle); - LLE_REQ_DESTROY(lle); - free(lle, M_LLTABLE); + in_lltable_destroy_lle_unlocked(lle); } static struct llentry * @@ -1277,8 +1286,10 @@ in_lltable_alloc(struct lltable *llt, u_ if ((flags & LLE_IFADDR) == LLE_IFADDR) { linkhdrsize = LLE_MAX_LINKHDR; if (lltable_calc_llheader(ifp, AF_INET, IF_LLADDR(ifp), - linkhdr, &linkhdrsize, &lladdr_off) != 0) + linkhdr, &linkhdrsize, &lladdr_off) != 0) { + in_lltable_destroy_lle_unlocked(lle); return (NULL); + } lltable_set_entry_addr(ifp, lle, linkhdr, linkhdrsize, lladdr_off); lle->la_flags |= LLE_STATIC; Modified: head/sys/netinet6/in6.c ============================================================================== --- head/sys/netinet6/in6.c Tue Apr 26 23:09:47 2016 (r298674) +++ head/sys/netinet6/in6.c Tue Apr 26 23:13:48 2016 (r298675) @@ -2056,6 +2056,17 @@ struct in6_llentry { /* * Do actual deallocation of @lle. + */ +static void +in6_lltable_destroy_lle_unlocked(struct llentry *lle) +{ + + LLE_LOCK_DESTROY(lle); + LLE_REQ_DESTROY(lle); + free(lle, M_LLTABLE); +} + +/* * Called by LLE_FREE_LOCKED when number of references * drops to zero. */ @@ -2064,9 +2075,7 @@ in6_lltable_destroy_lle(struct llentry * { LLE_WUNLOCK(lle); - LLE_LOCK_DESTROY(lle); - LLE_REQ_DESTROY(lle); - free(lle, M_LLTABLE); + in6_lltable_destroy_lle_unlocked(lle); } static struct llentry * @@ -2270,8 +2279,10 @@ in6_lltable_alloc(struct lltable *llt, u if ((flags & LLE_IFADDR) == LLE_IFADDR) { linkhdrsize = LLE_MAX_LINKHDR; if (lltable_calc_llheader(ifp, AF_INET6, IF_LLADDR(ifp), - linkhdr, &linkhdrsize, &lladdr_off) != 0) + linkhdr, &linkhdrsize, &lladdr_off) != 0) { + in6_lltable_destroy_lle_unlocked(lle); return (NULL); + } lltable_set_entry_addr(ifp, lle, linkhdr, linkhdrsize, lladdr_off); lle->la_flags |= LLE_STATIC;